HTTP

What This Skill Does

The HTTP skill enables OpenClaw AI to execute precise and robust network requests. It serves as a comprehensive toolkit for developers and agents needing to interact with RESTful APIs, web servers, and remote services. By enforcing industry best practices, the skill ensures that interactions remain secure, performant, and reliable. It handles complex scenarios like conditional requests, cache management, CORS preflight orchestration, and error handling, abstracting the underlying network complexity into clean, manageable operations for the agent.

Installation

To integrate this skill into your environment, use the OpenClaw command-line interface: clawhub install openclaw/skills/skills/ivangdavila/http

Use Cases

• API Integration: Connect OpenClaw to backend services while maintaining strict security via HSTS and CSP headers.
• Data Synchronization: Utilize ETag and If-None-Match headers to perform bandwidth-efficient updates, only downloading data when it has actually changed.
• Resilient Infrastructure: Implement robust retry logic with exponential backoff and idempotency keys to ensure critical actions, like financial transactions, succeed even in unstable network conditions.
• Asset Delivery: Manage static assets effectively using caching directives like public, immutable, and versioned headers to speed up agent performance.
• Range Requests: Efficiently download large files or logs by requesting specific byte offsets rather than entire payloads.

Example Prompts

1. "Perform a GET request to the user API, include an ETag check for caching, and ensure the request times out after 15 seconds if there is no response."
2. "Attempt to update the user profile with a PATCH request; include an idempotency key and handle a 409 Conflict error by suggesting a correction to the user."
3. "Fetch the large log file using a range request starting at the last 1024 bytes and ensure we respect the server's cache-control directives."

Tips & Limitations

• Redirects: Always favor 307 or 308 codes to preserve request methods; avoid 301/302 for POST operations as they may downgrade to GET.
• Caching: Distinguish clearly between no-store (sensitive) and no-cache (revalidation required). Don't forget the Vary header, as omitting it often leads to stale data being served.
• Security: Always treat external APIs as untrusted. Use X-Content-Type-Options and X-Frame-Options to prevent injection and clickjacking. Always implement exponential backoff with jitter to avoid hammering servers during outages.